Ever Known
This Privacy Policy applies to the Ever Known apps for iOS and Android, the authenticated service that lets those apps work together, and the Ever Known pages on the Goodale Studios website.
Ever Known is designed as a private, consent-led archive. It does not include advertising, public profiles, a public social feed, data-broker integrations, or cross-app behavioral tracking.
Ever Known can store profile details, stories, answers, relationships, people, photographs, audio, video, documents, voice recordings, pronunciations, timeline entries, preferences, future messages, permissions, trustee records, consent history, owner corrections, family contributions, and source or provenance records that you intentionally create.
When you use an in-app safety control, Ever Known also receives a private moderation report containing the report category, optional details, the reported contribution or generated AI response needed for review, its source identifiers where applicable, the reporter and archive identifiers, and whether an owner chose to block a contributor. Reports do not become archive memories or personality evidence.
This material can be deeply personal. Add information only when you have the right and appropriate consent to preserve it, and review the visibility of every sensitive record before sharing.
You can create or access an Ever Known account with email and password, Sign in with Apple on iOS, or Sign in with Google on Android. Every fresh password sign-in also requires a short-lived, single-use confirmation sent to the verified email address; an existing valid session can restore without another message. The service stores a salted password-derived verifier rather than the plain-text password, and stores only hashes of session, invitation, and sign-in-confirmation tokens. The apps keep the signed-in session in platform-protected Keychain or Keystore storage.
For provider sign-in, the app sends the signed Apple or Google identity token to the Ever Known service for signature, issuer, audience, time, and nonce verification. The service stores the provider name, the provider's stable account identifier, the provider-verified email address when supplied, and the Ever Known account to which that identity is linked. An Apple private-relay address can therefore be stored as the verified account address. Ever Known does not receive the Apple Account or Google Account password.
Provider identities are never silently merged into an existing Ever Known account only because an email address matches. Linking a provider to an existing account requires an authenticated, explicit link action, and the verified provider email must match that account. Account information is used to authenticate you, associate archives with their owner, deliver invited access, synchronize permission changes, and apply verified subscription access across iOS and Android.
To limit abusive or automated requests, the service processes the request source address and, on account entry points, the normalized email address into separate keyed pseudonymous identifiers. Only short-lived counters are sent to the rate-limit store—normally for about one minute, or fifteen minutes for authentication and recovery—and those identifiers are not used to infer location, advertise, or track activity across services.
The private Ever Known backend is the canonical synchronized service for account identity, profiles, permissions, consent events, invitations, subscriptions, trustees, provenance, structured knowledge, family access, and authorized interaction across iOS and Android. Metadata is stored in Neon Postgres, while large original media is stored as private objects in Vercel Blob. Media access uses short-lived, authorization-checked links; it is not published as a public archive.
Each app also keeps an offline-capable working copy in its private application storage: SwiftData and protected app media storage on iOS, and Room plus protected app media storage on Android. Private iCloud or CloudKit is not the canonical Ever Known database and is not used for cross-platform authorization.
An owner can create a portable backup and choose iCloud Drive, Google Drive, device storage, an external drive, or another system document provider. The portable package contains readable metadata and available original files so irreplaceable human-created material does not depend permanently on Goodale Studios infrastructure. The selected provider processes that backup under the owner’s account and choices; Goodale Studios does not receive the owner’s personal-cloud password through this export flow.
Ever Known records separate, versioned consent events for profile creation, synchronized storage, AI processing, AI representation, voice-sample collection, synthetic voice, posthumous AI operation, authorized-family access, family contributions, and future messages. A server-received event is timestamped by the service and retains the consent-document identifier, version, state, app/platform information, and a hash identifying the displayed language.
Microphone permission and preserving an original voice recording do not authorize synthetic voice. Synthetic voice and posthumous synthetic or AI operation require separate affirmative authorization. A living owner can stop future AI representation or revoke synthetic-voice authorization without automatically deleting original recordings and other human-created archive material.
No production synthetic-voice provider is configured. Any future voice feature is intended to operate only inside a controlled, permission-filtered Ever Known experience; authorized relatives will not receive unrestricted text-to-speech capability in another person’s voice.
An owner can create a time-limited, one-time invitation for a named person and may bind it to an email address. Accepting an invitation records the viewer identity, profile, access level, and person identity needed to enforce Named People permissions.
Permission is checked before subscription tier. Basic viewers receive only permitted records marked as Shared Essentials. Premium viewers can receive all non-AI records the owner granted. Only Me and Never Share records are excluded from viewer access, and owners can revoke future access.
Never Share is owner-only. It overrides family relationship, trustee status, invitation, subscription, search, summaries, AI retrieval, direct media requests, and viewer export. An owner’s complete personal backup may contain Never Share material, so it is saved to an owner-selected storage destination rather than offered as a viewer export.
Basic is free and includes up to 250 MB of synchronized original media. Premium is an auto-renewable subscription with U.S. pricing of $4.99/month or $39.99/year for preservation, up to 5 GB of synchronized original media, family and legacy workflows, portable backup, and all non-AI material an owner grants. Apple or Google processes payment information; Ever Known receives product, transaction, or purchase-token information needed to verify the subscription and apply the account-level entitlement across platforms. Goodale Studios does not receive full payment-card details.
Ever Known AI’s U.S. pricing is $12.99/month or $99.99/year. It includes Premium and can unlock consent-controlled, source-grounded AI text conversations for an authenticated account with an active entitlement in supported builds. A subscription never overrides the owner’s permissions or separate AI consent. Synthetic or cloned voice is not included or enabled and remains a possible future feature requiring separate affirmative authorization.
Grounded AI text conversations require an authenticated account with an active Ever Known AI entitlement and the archive owner’s separate authorization for AI processing and representation. The service selects permission-filtered source records itself rather than trusting client-supplied source documents, and it excludes Only Me, Never Share, and otherwise unauthorized material from viewer conversations.
To generate a text response, Ever Known sends the user’s question, limited conversation context needed for continuity, and selected permitted archive excerpts to the OpenAI API. OpenAI processes that material to return generated text. Unsupported questions must receive an honest “I don’t know” response instead of invented archive facts. No production synthetic-voice or voice-cloning provider is configured, and the text-conversation feature does not generate audio in the preserved person’s voice.
An AI response is an interpretation generated from permitted sources. It is not the archived person, consciousness, resurrection, communication from an afterlife, therapy, or professional advice. AI interpretations do not silently become canonical owner history, unsupported questions must produce an honest unknown response, and source or inference labels are retained where available.
Ever Known requests microphone, camera, photo, file, notification, or device-authentication access only when the related feature needs it and the platform requires permission. Selected or recorded media is used to preserve the item the user chose to add.
Ever Known preserves selected photos, videos, and documents as original files. An original file may contain embedded metadata, including a precise capture location, even though Ever Known does not request device location permission or use that metadata for advertising, tracking, or discovery. Remove location metadata before adding a file if you do not want it preserved and synchronized with that original.
Apple, Google, Vercel, Neon, Upstash, Resend, and OpenAI process limited information as platform or service providers for the functions described here. OpenAI processes the question, limited conversation context, and selected permitted archive excerpts needed to generate grounded AI text; Upstash supports abuse-resistant request limiting, and Resend delivers account verification, fresh-sign-in confirmation, and password-recovery messages. Other apps or recipients receive archive material only when an owner deliberately saves or shares an export through a system feature. A recipient may keep a copy outside Ever Known, and revocation cannot retrieve copies already exported or saved elsewhere.
Owners can export a portable archive and delete profiles. Once a connected account-deletion request completes, the Ever Known service removes the account, active sessions, service-side entitlements, viewer authorizations, consent records and owned archive metadata from Neon, plus owned private media from Vercel Blob. A local working copy can remain on this or another device until the user deletes that archive or clears the app’s data separately. Offline service-deletion requests are queued for retry, so hosted deletion completes after the device reconnects.
A private moderation report may be retained for up to 180 days to review abuse, safety, privacy, or policy concerns. A report can be retained longer only where reasonably required for security, legal compliance, or a dispute; report content is not used to create archive memories, personality evidence, or advertising profiles.
Step-by-step in-app and web request instructions are available at https://goodalestudios.com/ever-known/delete-account.
Store providers may retain transaction records under their own rules. Goodale Studios may retain narrowly limited security, fraud, deletion-receipt, or dispute records when reasonably required by law or legitimate protection needs, while excluding archive content where feasible; the final retention schedule must be approved before launch. Production requests use HTTPS, access is filtered on the server, private media is not intended to be publicly enumerable, and the apps use platform-protected storage. No system can guarantee absolute security.
Ever Known is not intended for children to create accounts independently. A parent or guardian should supervise a minor’s use and decide whether information about a child may lawfully and appropriately be preserved or shared.
Do not send passwords, store credentials, private archive exports, recordings, or sensitive family information to support unless it is necessary, you intend to share it, and you have removed unrelated private details.
The Goodale Studios website host may process routine request information such as IP address, browser type, requested page, response status, and timestamp to deliver and secure the website. Public website activity is separate from the private Ever Known archive.
If you email support@goodalestudios.com, Goodale Studios receives your email address and anything you include so the request can be answered, investigated, and retained as reasonably needed for support, security, or legal obligations.
Privacy questions, access requests, and deletion questions may be sent to support@goodalestudios.com. Material changes will appear on this page with a revised effective date.
